Personally I'd just push this to master and release in 3.6.2. This isn't worth a security release - we've already fixed a similar bug in 3.6.1. Whilst SMB2 isn't on by default I think we're ok with this. There's no danger of a privilege escalation here.
Jeremy.